Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 27 subscribers
  • Views 1436 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't access Clients in configured VLAN

Patrick Styra

Hello,

 

i have a problem and i can't get a clue.

I configured a Vlan in a separate Subnet.

As i read it's recommended to put a Any-Any-Rule for Lan.

So i did but i still can't access the clients in this subnet. I only can ping the Vlan-Gateway.

even the Log tells me the right Routing on the right Ports, but remaining unanswered

As well the Clients in the Vlan can't access Wan evne there is a rule for it as well:

 

I bet i just oversee something necessary but i can't find it so im asking kindly for help.



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

     

    as for WAN Access  - you prabably need a MASQ Rule to use your routers WAN IP Address when websurfing.

    Did you try anything else than ping in your LAN? Ping maybe blocked by the firewall.

    The client uses the Firewall's IP as Gateway?

    I would suggest you use the policy tester tab in the logviewer and check what it is saying about your requests.

     

    And an other tip: just go to the VLAN Interface and click safe without changing anything. Had similar issues with VLANs in the past...

  • 0 in reply to LHerzog

    there is a masquerading-rule for LAN. It works fine with all native Subnets, just for the VLAN (as well Member of LAN) not.

     

    everything is getting blocked. I have a client with a web-interface which isn't accessible. The policy tester don't show anything. All policy-rules are configured to "allow all".

    As you can see in my screenshot the firewall allows the ICMP-request, so i don't think its a blocking issue.

     

    I also tried the tip with just saving the VLAN-Interface once again but nothing happened. The Gateway-IP is the Firewalls Vlan-IF-IP.

Reply
  • 0 in reply to LHerzog

    there is a masquerading-rule for LAN. It works fine with all native Subnets, just for the VLAN (as well Member of LAN) not.

     

    everything is getting blocked. I have a client with a web-interface which isn't accessible. The policy tester don't show anything. All policy-rules are configured to "allow all".

    As you can see in my screenshot the firewall allows the ICMP-request, so i don't think its a blocking issue.

     

    I also tried the tip with just saving the VLAN-Interface once again but nothing happened. The Gateway-IP is the Firewalls Vlan-IF-IP.

Children
  • 0 in reply to Patrick Styra

    I think you have to use GUI Packet Capture tool in Diagnostics to see through which FW interfaces the packets from out of 192.168.2.0 to 192.168.78.0 and especially back really go.

    We noticed strange things in log viewer not showing packets that are seen and allowed or blocked in packet capture.

    What you mean with "The policy tester don't show anything." is it blank?

  • 0 in reply to LHerzog

    So i used the packet capture.

     

    When i connect to the VLan-GW its show up the Status "Consum..."

    When i try connecting to a Client in the Vlan it show "Forward.." with the rule ID 7 as the accepting LAN-LAN-rule

    In addition the connection list shows up the connection status "SYN_SENT, UNREPLIED"

     

    The opposite way it doesn't show up anything but Broadcasts which are shown in the interface Port 4 instead of 4.5 (which is the Vlan)

     

    So nothing which really helps

     

    Any clues?

    Else i will try to catch the traffic between the Vlan-client and the Firewall with Wireshark to see what exactly goes out and what not

  • 0 in reply to Patrick Styra

    Can the network devices in 78.0/24 ping the RED gateway IP 78.1?

    If not, can you check on XG SSH shell with ifconfig if the VLAN adapter has this IPv4 address?

    If yes do they really use this IP as gateway to 2.0/24 subnet? Is the XG configured as DHCP server there?

  • 0 in reply to LHerzog

    No, the Clients in the Vlan cannot ping the GW-IP but the other subnets can.

    The Clients in the Vlan don't get any IP-Adresse via DHCP.

    When i configure static IP i can't access more than the other clients in thre Vlan-Subnet.

    I think i will switch to another Hardware. I don't know what else to try. Maybe i will just reset the Sophos and try it again